mlsanityData to 14 Oct 2026

Certified Defences Against Adversarial Patch Attacks on Semantic Segmentation

arXiv 2209.05980 ↗First posted 13 Sep 2022cs.CV cs.AI cs.CRcited by 16

Not on the map. Why?

Abstract (arXiv)

Adversarial patch attacks are an emerging security threat for real world deep learning applications. We present Demasked Smoothing, the first approach (up to our knowledge) to certify the robustness of semantic segmentation models against this threat model. Previous work on certifiably defending against patch attacks has mostly focused on image classification task and often required changes in the model architecture and additional training which is undesirable and computationally expensive. In Demasked Smoothing, any segmentation model can be applied without particular training, fine-tuning, or restriction of the architecture. Using different masking strategies, Demasked Smoothing can be applied both for certified detection and certified recovery. In extensive experiments we show that Demasked Smoothing can on average certify 64% of the pixel predictions for a 1% patch in the detection task and 48% against a 0.5% patch for the recovery task on the ADE20K dataset.

Key facts. Cited by 16 papers in the map (data through 14 Oct 2026). Builds on 35 of its 46 references that are in the map. First posted on arXiv 13 Sep 2022.

Builds on

35 of 46 references.

References · 35

  1. 2020An Image is Worth 16x16 Words: Transformers for Image Recognition at Scalecited by 30,186
  2. 2021Swin Transformer: Hierarchical Vision Transformer using Shifted Windowscited by 12,139
  3. 2021Masked Autoencoders Are Scalable Vision Learnerscited by 7,403
  4. 2016Grad-CAM: Visual Explanations from Deep Networks via Gradient-based Localizationcited by 6,733
  5. 2018Encoder-Decoder with Atrous Separable Convolution for Semantic Image Segmentationcited by 3,223
  6. 2016Pyramid Scene Parsing Networkcited by 2,479
  7. 2021BEiT: BERT Pre-Training of Image Transformerscited by 2,375
  8. 2019Certified Adversarial Robustness via Randomized Smoothingcited by 1,340
  9. 2016COCO-Stuff: Thing and Stuff Classes in Contextcited by 864
  10. 2021Resolution-robust Large Mask Inpainting with Fourier Convolutionscited by 738
  11. 2017Adversarial Patchcited by 517
  12. 2019Approximating CNNs with Bag-of-local-Features models works surprisingly well on ImageNetcited by 260
23 more
  1. 2018LaVAN: Localized and Visible Adversarial Noisecited by 113
  2. 2020Certified Defenses for Adversarial Patchescited by 101
  3. 2020(De)Randomized Smoothing for Certifiable Defense against Patch Attackscited by 98
  4. 2019On Physical Adversarial Patches for Object Detectioncited by 93
  5. 2018Local Gradients Smoothing: Defense against localized adversarial attackscited by 87
  6. 2022Incremental Transformer Structure Enhanced Image Inpainting with Masking Positional Encodingcited by 83
  7. 2016Places: An Image Database for Deep Scene Understandingcited by 76
  8. 2019Defending Against Physically Realizable Attacks on Image Classificationcited by 66
  9. 2021PatchCleanser: Certifiably Robust Defense against Adversarial Patches for Any Image Classifiercited by 65
  10. 2018SPG-Net: Segmentation Prediction and Guidance Network for Image Inpaintingcited by 58
  11. 2021Evaluating the Robustness of Semantic Segmentation for Autonomous Driving against Real-World Adversarial Patch Attackscited by 55
  12. 2021Certified Patch Robustness via Smoothed Vision Transformerscited by 45
  13. 2022Towards Practical Certifiable Patch Defense with Vision Transformercited by 44
  14. 2020Minority Reports Defense: Defending Against Adversarial Patchescited by 36
  15. 2021Scalable Certified Segmentation via Randomized Smoothingcited by 35
  16. 2021DetectorGuard: Provably Securing Object Detectors against Localized Patch Hiding Attackscited by 29
  17. 2021PatchGuard++: Efficient Provable Attack Detection against Adversarial Patchescited by 29
  18. 2021Efficient Certified Defenses Against Patch Attacks on Image Classifierscited by 24
  19. 2022Give Me Your Attention: Dot-Product Attention Considered Harmful for Adversarial Patch Robustnesscited by 23
  20. 2022ObjectSeeker: Certifiably Robust Object Detection against Patch Hiding Attacks via Patch-agnostic Maskingcited by 22
  21. 2021Efficient Self-Ensemble for Semantic Segmentationcited by 16
  22. 2021ScaleCert: Scalable Certified Defense against Adversarial Patches with Sparse Superficial Layerscited by 15
  23. 2020DeepGIN: Deep Generative Inpainting Network for Extreme Image Inpaintingcited by 11

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2022: 3; 2023: 7; 2024: 4; 2025: 1; 2026: 1.

16 papers.

Sort:

By area:

  1. 2023SmoothLLM: Defending Large Language Models Against Jailbreaking Attackscited by 469
  2. 2022Visual Adversarial Attacks and Defenses in the Physical World: A Surveycited by 11
  3. 2023PatchCURE: Improving Certifiable Robustness, Model Utility, and Computation Efficiency of Adversarial Patch Defensescited by 11
  4. 2022Localized Randomized Smoothing for Collective Robustness Certificationcited by 10
  5. 2023Adversarial Examples in the Physical World: A Surveycited by 10
  6. 2023Uncertainty-weighted Loss Functions for Improved Adversarial Attacks on Semantic Segmentationcited by 9
  7. 2022Towards Improved Input Masking for Convolutional Neural Networkscited by 8
  8. 2023PECAN: A Deterministic Certified Defense Against Backdoor Attackscited by 5
  9. 2023Uncertainty-based Detection of Adversarial Attacks in Semantic Segmentationcited by 5
  10. 2023Towards Better Certified Segmentation via Diffusion Modelscited by 2
  11. 2024Effects of Exponential Gaussian Distribution on (Double Sampling) Randomized Smoothingcited by 1
  12. 2024Detecting Adversarial Attacks in Semantic Segmentation via Uncertainty Estimation: A Deep Analysiscited by 1
4 more
  1. 2025PatchDEMUX: A Certifiably Robust Framework for Multi-label Classifiers Against Adversarial Patchescited by 1
  2. 2024A Model for Combinatorial Dictionary Learning and Inferencecited by 0
  3. 2024Adversarial Manhole: Challenging Monocular Depth Estimation and Semantic Segmentation Models with Patch Attackcited by 0
  4. 2026MRCert: Towards Post-deployment Patch Robustness Certification for Adversarially Patched Samples via Type-specific Maskingcited by 0